Heading into the Future: The Dynamic Adaptable IA Training Assessment Tool!

Abstract

Information awareness training and assessment have not changed much in the last twenty years. Although most information awareness programs have an assessment, it is used as a check-the-box item. Employees are required to do the training and then take a test of between 10 and 20 questions and achieve a score of at least 70%. The results show that everyone in the organization has some risk, but this information does not help cybersecurity professionals identify and mitigate the risk. With human beings being the primary attack vector, we need to do more to understand people and develop ways of changing behaviour. The Dynamic Adaptable IA Training Assessment Tool developed for this study uses a novel approach to include human behaviours and social media usage factors as part of a susceptibility algorithm designed to assess better an employee’s risk of becoming a victim of cybercrime. This study demonstrates that the current methods of assessing risk within an organization lead to a false sense of security. Reinforcing the need to change how we assess risk within an organization.